>From 2df7945d7259e9695d21d6645fb6d3ad8d0da67d Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Thu, 23 Jan 2014 01:12:21 -0500 Subject: [PATCH 06/10] Moved sshd_disable_empty_passwords to shared/ - Tested on RHEL7, updated CPE - Symlinks - Added to rhel7 rht-ccp profile --- .../input/checks/sshd_disable_empty_passwords.xml | 32 +--------------------- .../input/checks/sshd_disable_empty_passwords.xml | 1 + scap-security-guide.spec | 1 + shared/oval/sshd_disable_empty_passwords.xml | 32 ++++++++++++++++++++++ 4 files changed, 35 insertions(+), 31 deletions(-) mode change 100644 => 120000 RHEL/6/input/checks/sshd_disable_empty_passwords.xml create mode 120000 RHEL/7/input/checks/sshd_disable_empty_passwords.xml create mode 100644 shared/oval/sshd_disable_empty_passwords.xml diff --git a/RHEL/6/input/checks/sshd_disable_empty_passwords.xml b/RHEL/6/input/checks/sshd_disable_empty_passwords.xml deleted file mode 100644 index 0a9d846..0000000 --- a/RHEL/6/input/checks/sshd_disable_empty_passwords.xml +++ /dev/null @@ -1,31 +0,0 @@ - - - - Disable Empty Passwords - - Red Hat Enterprise Linux 6 - - Remote connections from accounts with empty passwords should - be disabled (and dependencies are met) - - - - - - - - - - - - /etc/ssh/sshd_config - ^[\s]*(?i)PermitEmptyPasswords[\s]+no[\s]*$ - 1 - - diff --git a/RHEL/6/input/checks/sshd_disable_empty_passwords.xml b/RHEL/6/input/checks/sshd_disable_empty_passwords.xml new file mode 120000 index 0000000..e8169f0 --- /dev/null +++ b/RHEL/6/input/checks/sshd_disable_empty_passwords.xml @@ -0,0 +1 @@ +../../../../shared/oval/sshd_disable_empty_passwords.xml \ No newline at end of file diff --git a/RHEL/7/input/checks/sshd_disable_empty_passwords.xml b/RHEL/7/input/checks/sshd_disable_empty_passwords.xml new file mode 120000 index 0000000..e8169f0 --- /dev/null +++ b/RHEL/7/input/checks/sshd_disable_empty_passwords.xml @@ -0,0 +1 @@ +../../../../shared/oval/sshd_disable_empty_passwords.xml \ No newline at end of file diff --git a/scap-security-guide.spec b/scap-security-guide.spec index 517a06d..57710fa 100644 --- a/scap-security-guide.spec +++ b/scap-security-guide.spec @@ -59,6 +59,7 @@ cp -a RHEL/6/input/auxiliary/scap-security-guide.8 %{buildroot}%{_mandir}/en/man - OVAL for sshd_set_keepalive - OVAL for sshd_disable_rhosts - OVAL for sshd_disable_root_login +- OVAL for sshd_disable_empty_passwords * Tue Dec 24 2013 Shawn Wells 0.1-16.rc2 + RHEL6 stig-rhel6-server XCCDF profile renamed to stig-rhel6-server-upstream diff --git a/shared/oval/sshd_disable_empty_passwords.xml b/shared/oval/sshd_disable_empty_passwords.xml new file mode 100644 index 0000000..81032c7 --- /dev/null +++ b/shared/oval/sshd_disable_empty_passwords.xml @@ -0,0 +1,32 @@ + + + + Disable Empty Passwords + + Red Hat Enterprise Linux 6 + Red Hat Enterprise Linux 7 + + Remote connections from accounts with empty passwords should + be disabled (and dependencies are met) + + + + + + + + + + + + /etc/ssh/sshd_config + ^[\s]*(?i)PermitEmptyPasswords[\s]+no[\s]*$ + 1 + + -- 1.8.3.1